1. Institute periodic enterprise-wide risk assessments.
Want to compare security products? Visit the IT Buyer's Guides now.

The organization must take an enterprise-wide view of information security, first determining its critical assets, then defining a risk management strategy for protecting those assets from both insiders and outsiders.

2. Institute periodic security awareness training for all employees.

All employees in an organization must understand that security policies and procedures exist, that there is a good reason why they exist, that they must be enforced, and that there can be serious consequences for infractions.

Related Content

        * Details emerging on Hannaford data breach
        * Banks sue TJX
        * FTC wants answers
        * Case study in what to do wrongBLOG
        * TJX apology: We give it a 5
        * Sloppy companies, not hackers
        * Bill puts onus on retailers
        * Boards need to wake upBLOG
        * TJX data criminal gets five years in prison
        * Cost of data breaches varies

    Search for articles like this one

3. Enforce separation of duties and least privilege.

Effective separation of duties requires the implementation of least privilege; that is, authorizing people only for the resources they need to do their jobs.

4. Implement strict password and account management policies and practices.

If the organization’s computer accounts can be compromised, insiders have an opportunity to circumvent both manual and automated mechanisms in place to prevent insider attacks.

5. Log, monitor, and audit employee online actions.

Logging, periodic monitoring, and auditing (Compare Network Auditing and Compliance products) provide an organization the opportunity to discover and investigate suspicious insider actions before more serious consequences ensue.

6. Use extra caution with system administrators and privileged users.

Typically, logging and monitoring is performed by a combination of system administrators and privileged users. Therefore, additional vigilance must be devoted to those users.

7. Actively defend against malicious code.

System administrators or privileged users can deploy logic bombs or install other malicious code on the system or network. These types of attacks are stealthy and therefore difficult to detect ahead of time, but practices can be implemented for early detection (Compare Patch and Vulnerability Management products).

8. Use layered defense against remote attacks.

Insiders tend to feel more confident and less inhibited when they have little fear of scrutiny by coworkers; therefore, remote access policies and procedures must be designed and implemented very carefully.

9. Monitor and respond to suspicious or disruptive behavior.

In addition to monitoring online actions, organizations should closely monitor other suspicious or disruptive behavior by employees in the workplace. Policies and procedures should be in place for employees to report such behavior when they observe it in coworkers, with required follow-up by management. 

10. Deactivate computer access following termination.
Want to compare security products? Visit the IT Buyer's Guides now.

When an employee terminates employment, whether the circumstances were favorable or not, it is important that the organization have in place a rigorous termination procedure that disables all of the employee’s access points to the organization’s physical locations, networks, systems, applications, and data.

11. Collect and save data for use in investigations.

Should an insider attack, it is important that the organization have evidence in hand to identify the insider and follow up appropriately.

12. Implement secure backup and recovery processes.

It is important that organizations prepare for the possibility of an attack or disruption by implementing secure backup and recovery processes that are tested periodically (Compare Data Backup and Replication products).

13. Clearly document insider threat controls.

As an organization acts to mitigate insider threat, clear documentation will help to ensure fewer gaps for attack, better understanding by employees, and fewer misconceptions that the organization is acting in a discriminatory manner.

For more details about the 13 best practices, read the July 2006 report "Commonsense Guide to Prevention and Detection of Insider Threats" published by the Carnegie University CyLab. You can find it on the CERT Web site:
http://www.cert.org/insider_threat/